The Cloud and IPv6 Company IPv6 and Cloud

Transcription

1 The Cloud and IPv6 Company IPv6 and Cloud Ciprian Popoviciu Shixiong Shang

2 Agenda The IPv6 and Cloud Story IPv6 and OpenStack Overview IPv6 and OpenStack Case Study Conclusion 2

3 A Little Bit About Us ( Nephos (νέφος) = Cloud, 6 = IPv6 ) IPv6 Cloud Education Consulting Product 3

4 The IPv6 and Cloud Story The promise of Cloud cannot be delivered without IPv6

5 Three Four Major Inflection Points Driver Business Results SDN The inflection points are complex, simultaneous, interdependent and touch every aspect of IT 5

6 Benefits of IPv6 Based Clouds Addressing, addressing, addressing Direct access to Cloud resources Sufficient address space Do not trivialize the power of plentiful IP address space Easier management Protocol Specific Considerations SLAAC as a provisioning option NDP which is better than ARP Great opportunities for innovation New architectural models, such as VXLAN, MAP 6

7 Adoption and Trends Public Cloud: Full IPv6 support has a way to go. New entrants offer IPv6 early on and do it very well. With mobile traffic going mostly over IPv6, how can a public cloud provider not offer native IPv6 access? Private Cloud: Demand for IPv6 enabled OpenStack is accelerating however OpenStack is not ready despite claims it is. With more proof that IPv6 based data centers can be more efficiently managed, how would enterprises not ask for IPv6 enabled OpenStack? 7

8 Adoption and Trends Yes No Yes Yes No Only Translation No Yes 8

9 A User Perspective We developed a SaaS based service assurance tool called v6sonar that monitors Cloud services over IPv4 and IPv6 v6sonar offers IPv4/IPv6 monitoring agents around the World using new, innovative IPv6 ready IaaS providers such as: Digital Ocean Vultr RamNode The backend is in Amazon because of ease of operations for a SaaS based product however, lack of IPv6 native is a major annoyance and one of the reasons we are weighing hosting options. 9

10 IPv6 and OpenStack Overview OpenStack is the top open-source IaaS platform but not ready for IPv6 primetime

11 OpenStack & IPv6 Demand OpenStack is the foundation of many large public clouds and private clouds of all sizes (top open-source IaaS platform in 2014) Large OpenStack cloud providers such as Cisco, Comcast, ATT, DT are experiencing the scaling constraints imposed by IPv4 and customers demanding IPv6 enabled Virtual Private Cloud Some organization rightfully align their IPv6 and cloud plans Greenfield OpenStack deployments are facing IPv6 compliance requirements New cloud provider market entrants see IPv6 as a differentiator More than 50% of mobile traffic is over IPv6 and most of the apps are SaaS based hence likely to operate on OpenStack IOT drives Cloud but IPv6 makes true IOT possible and cloud integration is critical 11

12 OpenStack & IPv6 Overview The initial IPv6 enablement work focuses on Neutron but touches Horizon as well Have to overcome many IPv4 centric assumptions Address architecture Provisioning options Control plane implementation Security considerations IPv6 provides new design options Must keep in mind dual-stack operation considerations. In Icehouse, configuring IPv6 on a non-enabled OpenStack infrastructure had major negative impact 12

13 OpenStack & IPv6 Challenges There are many claims of support however, all of them unsubstantiated through production grade deployments: Challenge Take Juno or most commercial release package and deploy with it an IPv6 enabled OpenStack cloud. Good luck! Architectural/Design challenges: To make it work, we are undoing the IPv4 centric view in Neutron We have yet to start being innovative based on IPv6 IPv6 security implementation 13

14 IPv6 & DevOps with Cloud DevOps challenges: There are no IPv6 related test cases in Tempest (public repository) or Rally (test scenarios) There are no monitoring tools No one really knows how to do it well Lack of IPv6 knowledge and experience Lack of experience operating IPv6 and just starting to learn about operating OpenStack 14

15 OpenStack & IPv6 Roadmap Claim: IPv6 Supported Reality: Nothing really works, IPv6 enablement negatively impacts deployments Claim: Full support of IPv6 Reality: -True support depends on deployment scenario -It is buggy -Entire scenarios not tested -No scale and performance numbers -Security left out Grizzly Havana Icehouse Juno Kilo Industry State of Art OpenStack Releases Patched OpenStack to support IPv6 First POC showing the operation of IPv6 enabled OpenStack First IPv6 Only Prod Deploymnt -Supporting EU election services in Germany -5% of traffic IPv6 Developed Pv6 blueprints for Neutron Patched RHEL/OSP 5 to support IPv6 Extensive Testing Unit test Functional test API test Negative test Scale/Performance test Dev of IPv6 ready tests of IPv6 enabled OpenStack IPv6 security hardening for operational readiness Scale testing in preparation for large scale production deployment Nephos6 Work (development is aligned up to Kilo release) 15

16 IPv6 and OpenStack Case Study Todo, it is not markitecture anymore!

17 An Implementation Story Environment: Large Cloud Service Provider RHEL7/OSP5 based deployment Driver: Customer clear request for IPv6 support in order to deliver services from their VPC over IPv6 Approach: Take a provider model for service delivery where customer VMs are provisioned using SLAAC and Stateless DHCPv6 Customer DC Peering Facility CSP Cloud Environment Customer Router CSP Router CSP Router Tenant VM DHCPv4 BGP BGP Static Default Route IPv4 + IPv6 IPv4 + IPv6 IPv4 + IPv6 IPv6 Address (RA / SLAAC) 17

18 Implementation Aligned with the Neutron IPv6 subcommittee blueprints using the two new attributes. Attribute Description Possible Values ipv6_ra_mode ipv6_address_mode Determine who sends RA and which AMO bits are set. Determine how VM obtains IPv6 address, default gateway, and/or optional information Added several features to harden functionality and address IPv6 idiosyncrasies IPv6 security review and implementation dhcpv6-stateful dhcpv6-stateless slaac attr_not_specified (i.e. blank) dhcpv6-stateful dhcpv6-stateless slaac attr_not_specified (i.e. blank) Developed test methodology and test scripts for release process 18

19 Lessons Learned OpenStack community only provides the reference architecture. Any cloud provider, must tailor it for its own needs. Out of box solutions are just a pipe dream. During customization, a cloud provider needs to take several key factors into the consideration, like security, scalability and operations, which are completely ignored by the community A good DevOps process provides the much needed quality assurance. This is what OpenStack community lacks the most. Off the shelf OpenStack not ready for IPv6 enablement in production 19

20 Lessons Learned (cont.) We built code in full alignment with the community to avoid lock-in As we moved our code from earlier small deployments to this environment, we focused more on operational considerations: Support for an IPv6 enabled environment Making it easy to upgrade to future OpenStack releases Monitoring and metering We developed multiple test scripts for Tempest and Rally (there was no support for IPv6 enabled OpenStack) We did a security analysis and mitigated risk through code & process 20

21 6GEN Case Study Germany EU election result pages monitored from 22 residential users 21

22 Conclusions Waiting for others to do it is a losing game

23 Conclusion Address both inflection points, IPv6 and Cloud within a common, comprehensive, corporate wide strategy An IPv6 perspective will change your Cloud architecture for the better and vice versa For your public cloud needs you likely use Amazon push them to support IPv6, at least on par with IPv4 For your private cloud needs you likely use OpenStack push your vendor and the community to support IPv6 Trust IPv6 support claims but make sure you verify Remember, it is more than just a quick demo of functionality: test, scale, secure, deploy, monitor your IPv6 enabled Cloud. 23

24 The Promise of Cloud Cannot Be Fully Met Without IPv6

25 phone: web: (919) web: